Privacy policy
What we collect when you use Alcoven, why, where it is kept, and your rights over it.
In short
- Deep Node Studios Yazılım ve Teknoloji Limited Şirketi, in İstanbul, is responsible for your personal data in Alcoven.
- We collect what running Alcoven needs: your account, and what you and your agents write on projects. What you publish to the skills directory is public.
- The app and your projects are stored with Amazon Web Services in Frankfurt. Paddle handles payments as our merchant of record.
- We don’t sell your data, use it for advertising, or train models on it. alcoven.co sets no cookies, and our own server counts its visits without keeping your IP address.
- You can ask to see, correct, export or delete your data, or object to how we use it, at info@alcoven.co.
This summary helps you read. The numbered sections below are the policy.
1. Who is responsible for your data
DEEP NODE STUDİOS YAZILIM VE TEKNOLOJİ LİMİTED ŞİRKETİ, FENERBAHÇE MAH. İĞRİP SK. NO: 13 İÇ KAPI NO: 1, KADIKÖY / İSTANBUL, Türkiye (“we”, “us”) is responsible for the personal data of the people who use Alcoven at app.alcoven.co and visit alcoven.co. We are its controller under the EU General Data Protection Regulation (GDPR), and its data controller (veri sorumlusu) under Türkiye’s Law No. 6698 on the Protection of Personal Data (KVKK).
For anything about your data, write to info@alcoven.co.
The team that owns a project decides what goes into it. When a project holds other people’s personal data, for example a client’s name in a document, we process that data for the team, to run Alcoven.
2. What we collect, and why
Your account
Your name, your email address and your password. We keep the password only as a scrypt hash, so the password itself is never stored. If you sign in with a service such as Google or GitHub, the service tells us your email address and your name, and you have no password with us until you set one. We also keep the teams and projects you belong to, your role and permissions on each, and anything you write about yourself on a project.
We record each sign-up, sign-in, failed try and password change, with the IP address the request came from.
Why: to create your account, sign you in, show the people on your projects who you are, and stop people guessing passwords. Legal basis: our contract with you, and for the sign-in records, our legitimate interest in keeping accounts secure.
Emails we send you
Codes to confirm your address or set a new password; invitations to projects and teams; a member’s request to the people who run their team; a note when your password changes; and news about skills you publish to the skills directory, and a note when a skill on your project is removed from it.
As you choose under Email me: a question a member asks you, sent at once from their name with “via Alcoven” after it, so your reply goes to them; and, only if you turn them on, a summary on Mondays and an email each morning about what others changed while you were away.
If you stop partway through setting up your first project, you get one email the day after from Alcoven’s founder, shown as “Alperen via Alcoven”, with the button for the step where you stopped. A reply reaches him. There is never a second one, none goes once the step is done, and one press in it turns these emails off. When you ask on your phone for the link to the setup guide, we email it to you then or the next morning, as you choose.
Amazon SES sends all of them. We keep a record of each email except the codes (who it went to, what kind it was, when, and whether it went out). For every email, codes included, Amazon SES tells us whether it was delivered, delayed, bounced or marked as spam, and we record that with the address. When an address bounces for good or marks our email as spam, we stop sending to it.
Why: to run your account and the projects you are on, to help you finish setting up your first project, to stay within sending limits, and to stop emailing an address where our emails bounce or are marked as spam. Legal basis: our contract with you.
What you and your agents write
The content of your projects: the brief, documents and the files you upload, tasks, notes, and every past version. Each project’s history records who changed what, when, and from where (the app, git or an AI app).
Why: this is the service. We keep it, and show it to the people and agents on the project it is open to. Legal basis: our contract with you.
How you found us
When you make an account, we keep how you came to it: whether you signed up by email, with a service such as Google or GitHub, or from an invitation; the campaign tags in the link that brought you; the alcoven.co page you pressed it on; which version of the home page’s opening words you saw, if you saw one; the site you came from before (its domain only); and when you first arrived. In your first 30 days, the foot of your projects page asks where you heard about Alcoven until you answer or skip it. Answering is optional, and we keep your answer, or that you skipped, with its date.
Why: to know which posts, pages and places bring people to Alcoven. Legal basis: our legitimate interest in knowing where to spend our time.
Access for your own tools
The git tokens you create, the AI apps you allow to open a project (their name, when you allowed them, and their access tokens), and when each person cloned, fetched or pulled a project, so the project can show what changed since.
When you bring in or link a GitHub repository, you sign in to GitHub, and we hold your GitHub token for an hour at most, encrypted in a cookie, never in our database. A repository you bring in is copied into the project. A linked one stays on GitHub: we keep a list of its files and index them for search. The changes you choose to send go to GitHub.
Why: to let your tools in, and to keep the record straight. Legal basis: our contract with you.
Google Drive, Google Sheets and Google Analytics
Each project has its own address in Google: a Google service account Alcoven keeps for that project, shown in the app as the project’s Alcoven address. Once a Google Doc, a sheet or a Google Drive folder is shared with that address and someone on the project links or adds it there, Alcoven reads it for the people who see where it sits in the project, and the AIs they open the project in. Of a Google Doc it keeps only the newest text it read, to show and search it; of a sheet, the rows it last fetched, to draw its numbers and, where someone allowed it, to show them. It changes a Google Doc only when someone on the project confirms the change, and adds rows at the end of a sheet only where someone on the project allowed it. Removing the address from the file’s or folder’s sharing in Google stops it. After you pick them, Alcoven keeps none of your own Google access for files and folders read this way.
Of a linked Google Drive folder, Alcoven reads every file in it, and the files added to it later: Google Docs, Sheets, Slides, PDF, Word, Excel and other kinds. It keeps only the newest text it read in each file, to show and search it, and keeps no copy of the files themselves. When someone opens one of those files in the app, Alcoven fetches it from Google Drive to show it, and keeps it nowhere.
When a linked Google Doc changes in Google Docs, the project’s Changes say so with the name Google gives for whoever changed it and the sections that changed, never the words; those lines stay in the project’s history. When Alcoven adds rows to a sheet with by and from columns, it writes there the member id of the person who added each row and the AI they used.
The text of a linked Google Doc or of the files in a linked Google Drive folder, and a sheet’s rows where they are shown, reach the AI tools people on the project open it from (section 4).
When you link Google Docs, or a Google Drive folder you can share, from Google Drive, or add a sheet, you allow Alcoven, on Google’s screen, to open the files and folders you pick. Alcoven uses that access only for those: to check that your account opens them and, for Google Docs and folders, to share each one with the project’s Alcoven address. It holds that access encrypted in a cookie, for 15 minutes when you add a sheet and an hour at most when you link from Google Drive, and never in our database.
When you link a Google Drive folder you can view but not share, Alcoven can’t share it with the project’s Alcoven address, so it asks Google, on Google’s screen, for read access to your Google Drive. We keep that access encrypted in our database, for that project, and use it only to list and read the folders you linked with it, for the people on that project who see where they are linked. Alcoven never uses it to open anything else in your Google Drive, and never to change anything there. We delete it when you leave the project, when Google refuses it, or when no folder you linked with it is still linked. You can also take it back at any time in your Google Account, which stops those folders.
A Google Analytics source, and a sheet added before 21 October 2026, when sheets were still read on a person’s own access, run on the Google access of the person who added them. We keep that access, encrypted in our database, and use it only to read the numbers, every six hours unless the source’s Refresh line says otherwise. Removing the source, or moving the sheet to the project’s Alcoven address, deletes it, and the source stops if that person leaves the project. You can also remove Alcoven’s access in your Google account.
Alcoven’s use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
Why: to show the people on a project the documents and numbers it links, to make the changes they confirm and add the rows they allow. Legal basis: our contract with you.
The skills directory
When you publish a skill from a project to Alcoven’s directory at alcoven.co/skills, what you publish is public: your handle, the name you give beside it if you give one, the month you first published, and the skills you published, each version with its full text, its one-line summary, its category, its dates, what changed and the skill it was based on. We never show your email address, your projects, your team or the people on your projects beside a skill. A skill’s text is public as you wrote it, so before you send it, the publish page flags your project’s name and its people’s names, and turns down email addresses, phone numbers and keys.
When you publish a skill, you license it to everyone under the MIT licence: anyone may use, copy, change, share and sell it, as long as your handle stays in its notice. Copies people make keep your handle, and stay theirs after the skill leaves the directory. Before you publish, you state that you wrote the skill or may share all of it, and that it holds nothing private.
A person at Alcoven reads every skill and every version before it is public. When you report a skill, we keep the reason you chose and what you wrote with your account, and only we see who reported it. A report that a skill asks AIs to do something harmful pauses adding it at once, until we have looked. We may remove a version, telling its publisher why, or the whole skill, with the reason on its page, and we may restore it. When we remove a skill, the people who write on each project that holds it are told by email and on the project, and no AI on such a project is given the skill until one of them keeps or removes it. Removing a skill never changes a project’s copy of it.
You can withdraw a skill you published at any time. Its page then says you withdrew it and when, its text leaves the directory, and projects that added it keep their copy. A removed skill’s page keeps its address with your handle, the date and our reason.
We email you when a skill you sent is published or not, and when we remove or restore one. We also email the people who write on a project that holds a skill we removed. We send at most 20 of these emails to one address a day.
To rank the directory, we count from our own records how many projects have each of its skills, and how many used one: an AI read it there on at least two different days in the last 28. For this, we note each day which skill folders an AI read on each project (the project, the folder’s name, the day and the app or AI app it was read through), and delete those notes after 35 days. A project counts once. Projects under 7 days old, archived projects, projects the publisher is on, and Alcoven’s own projects are left out. A count is shown only at 3 or more, and none names a project or a person.
Why: to run the directory, keep it safe, and show which skills people use. Legal basis: for what you publish, our contract with you; for the review and reports, our legitimate interest in keeping the directory safe; for the counts, our legitimate interest in showing which skills are used, without naming a project or a person in public.
Pictures and scans read by a model
For each picture or scanned document a model reads (section 3): the project and the person it was for, the model, how much went in and came out, and when.
Why: to keep picture reading fair across teams and to prevent abuse. Legal basis: our contract with you, and our legitimate interest in preventing abuse.
Payments
Paddle collects your payment details, billing address and any tax number itself, as merchant of record. We never see your card number. Paddle sends us what we need to run the team’s plan: the customer’s name and email address, the plan, the number of seats, the state of the subscription, and the invoices.
Why: to give the team the plan it paid for, and to show its invoices. Legal basis: our contract with you, and our legal duty to keep financial records.
Messages you send us
What you write to info@alcoven.co; feedback you send from the app, with the page you were on and your browser’s name and version; and what you wrote on alcoven.slack.com, if you joined it.
Why: to answer you and to improve Alcoven. Legal basis: our contract with you when you ask for help with Alcoven, otherwise our legitimate interest in answering and improving it.
Technical records
When something fails, our servers record the error, which can include identifiers for your account, your team or a project.
Why: to keep Alcoven working and secure. Legal basis: our legitimate interest in running a secure service.
The website
alcoven.co sets no cookies and runs no advertising scripts. Vercel, which hosts it, and Cloudflare, which carries its traffic, process your IP address and the details of each request to deliver the pages and protect the site.
Our own server, at app.alcoven.co, counts visits. Each page of alcoven.co you open tells it which page it is, the site you came from (its domain only) and the campaign tags in the link you followed, if it had any. To count you once a day without a cookie, the server combines your IP address and the description your browser sends of itself (its name, version and system) with a random key that changes every day, and keeps only the result. Each day’s key is deleted by the second night after that day, and from then on nothing ties the visit to you. The server holds your IP address only in memory, for a minute at most, to stop one address flooding the count. When you press a sign-up or sign-in link, the page adds those tags, the page you were on and the site you came from to the link. When you press a link to another page of alcoven.co, the page adds those tags and the site you came from to that link, and the next page removes them from the address. If your browser sends Global Privacy Control, the pages do none of this.
On the home page, each visit is shown one of two versions of the opening words, picked at random when the page loads. A link to another page carries the version too, so you see the same one in that tab. When you press a sign-up or sign-in link, the page adds which version you saw to the link, with the details above, and the alcoven_src cookie carries it to your new account. The app records which version a visit saw and which version an account was made from, so we can tell which one leads more people to make an account. If your browser sends Global Privacy Control, the page adds nothing.
One page we share by link only, a template, is not counted. It loads its typeface from Google Fonts, so opening it sends your IP address to Google.
Legal basis: our legitimate interest in delivering and protecting the site, and in knowing which of our pages and posts bring people to the site, and which version of the home page’s opening words leads more of them to make an account.
The waitlist, now closed
Before sign-up opened, alcoven.co had a waitlist, stored with Supabase: an email address, the kind of project, and any answers to the optional questions that followed. The waitlist is closed. We keep those entries only to send one note that sign-up is open, and then we delete them, answers included.
Legal basis: your consent, given when you joined. You can withdraw it at any time by writing to us, and we delete your entry.
3. AI models
We don’t train models on your data. Alcoven uses one AI model: Claude Haiku 4.5, on Amazon Bedrock, reads the text in the pictures and scanned documents you add, so they can be searched. AWS says that neither AWS nor the model providers use inputs to or outputs from Bedrock to train any model, and that inputs and outputs are not shared with the model providers (Amazon Bedrock FAQs).
Bedrock may process each of these requests in any AWS region worldwide. Requests routed to another region travel on AWS’s own network, encrypted, and content Bedrock stores is kept at rest in Frankfurt (AWS on cross-region inference).
4. Your own AI tools
When you open a project from your own AI app over MCP, or clone it with git into a folder where a coding agent works, what you open goes to that tool and its provider. Your own agreement with them, and their privacy terms, apply to it. For that work, we run no model.
5. Cookies
alcoven.co sets no cookies. The app at app.alcoven.co uses these:
| Cookie | What it is for |
|---|---|
alcoven_session30 days | Keeps you signed in. |
alcoven_signup1 hour | Holds your sign-up, sealed so only our server can read it, while you confirm your email address. It is removed once used. |
alcoven_signin10 minutes | Holds a sign-in with Google, GitHub or another service, sealed so only our server can read it, while you are on that service’s page. It is removed once used. |
alcoven_gh1 hour | Holds your GitHub sign-in, encrypted so only our server can read it, while you bring in or link a GitHub repository. |
alcoven_src_try10 minutes | Holds your request, sealed so only our server can read it, while you are on Google’s page to add Google Analytics or a sheet, or to link Google Docs or a Google Drive folder, to a project. It is removed once used. |
alcoven_src_grant15 minutes, or 1 hour at most when you link from Google Drive | Holds what Google allowed, encrypted so only our server can read it, while you pick the Analytics property, the sheet, the docs or the folder. |
alcoven-leftalcoven-right-w1 year | Remember how you laid out a project’s panes. |
alcoven-theme1 year | Remembers Light, Dark or Match my system. |
alcoven-teams-seen1 year | Remembers when you last opened a team’s page, so Teams shows a dot only for what happened since. |
alcoven-invite-later1 year | Remembers the projects where you chose Not now on the prompt to invite someone. |
alcoven-billing-said5 minutes | Carries a short message about your team’s plan to the next page you open. |
alcoven_src30 days, or until you make an account | Remembers how you first reached sign-up or sign-in: the campaign tags in the link, the alcoven.co page you came from, the site before it, which version of the home page’s opening words you saw, if you saw one, and when. When you make an account, the account keeps them and the cookie is removed. It is not set if your browser sends Global Privacy Control. |
AWSALBAWSALBCORS7 days | Set by AWS’s load balancer, to keep your browser on the same server for the day, so a page open during an update keeps working. |
The app also keeps a few display choices in your browser’s own storage, such as which folders you folded. They stay on your device.
All of these but alcoven_src are needed for the app to work, or to remember a choice you made. alcoven_src is read only by us, and only to record on your new account how you came to it. There are no advertising cookies, and no cookies from analytics companies. When you pay, Paddle’s checkout runs in a frame from Paddle and may set its own cookies, as Paddle’s privacy notice describes. You can delete cookies in your browser at any time; deleting alcoven_session signs you out.
6. Where your data is kept, and who handles it
These providers process personal data for us:
- Amazon Web Services (AWS) runs the app, its database (encrypted at rest), the files you add, the search index, the backups, our server logs and the emails we send (Amazon SES), in Frankfurt, Germany (eu-central-1). Amazon Bedrock runs the model that reads pictures and scans (section 3).
- Vercel hosts alcoven.co, and Cloudflare carries its traffic.
- Google hosts our email.
- Slack ran alcoven.slack.com for the people who joined it.
- Supabase held the waitlist (section 2).
Paddle sells the paid plans as our merchant of record. It handles the sale, the subscription and payments, tax and invoicing, and decides for itself how it handles the data it collects, as Paddle’s privacy notice explains.
When you sign in with Google, GitHub or another service, bring in a GitHub repository, or link Google Docs, a Google Drive folder, Google Sheets or Google Analytics to a project, that service handles your sign-in and your files under its own privacy terms.
We also share personal data:
- with the people and agents on your projects: each sees what you write wherever it is open to them, and who changed it, and a project’s managers see all of it;
- with everyone, for what you publish to the skills directory (section 2): your handle, the name beside it if you give one, the month you first published, and your published skills;
- with professional advisers, such as lawyers and accountants, who must keep it confidential;
- with authorities, when the law requires it, or to protect people’s rights and safety;
- with a buyer or successor, if our company is merged or sold, and we will tell you if that happens.
We don’t sell personal data or share it for advertising.
7. Transfers abroad
Alcoven runs outside Türkiye, so using it transfers your personal data abroad:
- to AWS, in Germany, and in other AWS regions worldwide for the model in section 3;
- to Paddle;
- to Vercel, Cloudflare, Google, GitHub and Slack, which run their services in many countries, including the United States;
- for the waitlist, to Supabase.
Each of them processes it under the data protection terms it publishes.
8. How long we keep it
- Your account: while you have one. When you ask us to delete it, we delete your account details. What you wrote on projects stays on them under your name, as part of each project’s history, for as long as the project is kept.
- Projects: as long as the team keeps them. A closed project stays on our systems until the team asks us to delete it.
- Records of pictures and scans read, and billing records: as long as tax and accounting law requires.
- Server logs: 30 days.
- Sign-in records and the record of emails sent: we have not set an end date yet. Until we do, they are kept, and you can ask us to delete yours.
- Database backups: 7 days, so deleted data is gone from them within 7 days.
- Messages and feedback: as long as we need them to answer you and follow up.
- The waitlist: until the note that sign-up is open has gone out.
- Visits to alcoven.co: each visit’s record (the page, the site before it, the campaign tags, the time, that day’s code for the browser and, for a visit to the home page, the version of its opening words it was shown) is kept. The daily key that could tie that code to an IP address and browser is deleted by the second night after its day.
- How you found us: with your account, and deleted with it.
- Google Docs and Google Drive folders linked from Google Drive: the newest text Alcoven read in each file, until the link stops or is removed.
- Your Google access for a Google Drive folder you can only view: until you leave the project, Google refuses it, or no folder you linked with it is still linked.
- Google access for a source: until the source is removed or a sheet moves to the project’s Alcoven address.
- Sheets read as the project’s Alcoven address: the rows Alcoven last fetched, until the source is removed.
- Lines on Changes about linked Google Docs: with the project’s history.
- Which skill folders AIs read on each project, by day: 35 days.
- Skills you published and your handle: while the skill is in the directory; after you withdraw it or we remove it, its page keeps your handle and the date.
- Reports, and the directory’s record of who published, checked, reported or removed what: we have not set an end date yet. Until we do, they are kept.
When we no longer need personal data, we delete it or make it anonymous.
9. How we protect it
The database is encrypted at rest, and everything sent to and from Alcoven travels over HTTPS. Only the people who run Alcoven can reach its production systems. Passwords are kept only as scrypt hashes. If a breach puts your personal data at risk, we will tell you and the authorities as the law requires.
10. Your rights
You can ask us to:
- tell you whether we hold personal data about you, and give you a copy;
- correct it;
- delete it;
- give it to you in a form you can take elsewhere (you can also clone or download any project you can read);
- limit how we use it, or stop using it where we rely on our legitimate interests;
- tell the providers we shared it with about a correction or deletion.
Where we rely on your consent, you can withdraw it at any time. Under the KVKK, you can also:
- ask what we use your data for, and whether we use it only for that;
- learn who receives it, in Türkiye or abroad;
- object to a result that goes against you when it comes only from software analysing your data;
- claim compensation if unlawful processing harms you.
Software alone never makes a choice about you that has legal or similarly significant effects.
How to ask: write to info@alcoven.co from the email address on your account, or tell us how we can check it is you. We answer free of charge, as soon as we can: within one month under the GDPR, and within 30 days under the KVKK. We may keep what the law requires us to keep, and what you wrote on a project stays in that project’s history for the team.
Complaints: you can complain to a data protection authority: in the EU or EEA, the one where you live or work (list of authorities); in the UK, the Information Commissioner’s Office; in Türkiye, the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, kvkk.gov.tr). Under the KVKK, you write to us first; you can then complain to the Board within 30 days of our answer, or within 60 days of your request if we have not answered.
11. Children
Alcoven is meant for people aged 16 or over, and we don’t knowingly collect data from anyone younger. If you believe someone under 16 has given us personal data, write to us and we will delete it.
12. Changes to this policy
We may update this policy. We publish each version here with its date, and when a change matters to you, we tell you by email or in the app before it applies. The terms and the refund policy sit beside it.
13. Contact
Write to info@alcoven.co, or by post to DEEP NODE STUDİOS YAZILIM VE TEKNOLOJİ LİMİTED ŞİRKETİ, FENERBAHÇE MAH. İĞRİP SK. NO: 13 İÇ KAPI NO: 1, KADIKÖY / İSTANBUL, Türkiye.